Submeter #929821: PMWeb v7.x, v8.x, v2025.x Missing Authentication for Critical Function

Title:
Unauthenticated Access to Downloader That Leads to Usage of Downloader Features

A vulnerability was identified in the Downloader component (downloader.aspx) of PMWEB Project Management Platform. The endpoint does not enforce authentication prior to processing requests, allowing any remote, unauthenticated party to invoke Downloader functionality directly.

Because no session or credential validation is performed before the endpoint's file retrieval logic executes, an unauthenticated requester can exercise the same functionality as an authenticated user, including submitting FullFileName and FileName parameters and receiving file content in response. This removes any barrier that would otherwise limit exploitation of Downloader-related weaknesses to authenticated users only, and combined with other Downloader weaknesses, substantially lowers the effort required for exploitation.

POC Steps

1. Identify a PMWEB server exposing the downloader.aspx endpoint.
2. Without providing any session cookie, authentication token, or prior login, send a direct HTTP request to downloader.aspx with valid FullFileName and FileName parameter values.
3. Observe that the server processes the request and returns a response without redirecting to a login page or returning an authentication error.
4. Confirm that no valid session or credential was required at any point in the request flow.

Credits

The following individuals and organizations are credited for the discovery and coordination of these findings:
● Abdullah AlJaber
● Abdulmajeed AlDayel
● Mohammad AlHumaid
● Saudi Arabia National Cybersecurity Authority (NCA)
● Saudi Information Technology Company (SITE)

• Utilizador: aljaber (UID 99098)
• Submissão: 15/08/2026 02h26 (há 1 mês)
• Moderação: 27/09/2026 20h48 (1 month later)
• Estado: Duplicado
• Entrada VulDB: 410954 [PMWeb 7.x/8.x/2025.x downloader.aspx FullFileName/FileName Travessia de Diretório]
• Pontos: 0